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Amendme nts to the Claims : 
This listing of claims replaces all prior versions and listings of claims in ihc appHcalion: 

Lislinja of Claim s: 

1 , (Currently Amended) An anicic comprising a machine-readable medium 
embodying wferRK>tioi>4H dioativ e of instnictions that when performed by one or more machines 
result in operations comprising; 

determining whether a storage device, in a data processing system running an operating 
system, includes a protected area, the operating system including a hardware abstraction layer; 

removing the storage area protection of the storage device from within the running 
operating system and without rebooting the data processing system; and 

providing information derived from the formerly protected storage area to a data 
processing system detection tool- 

wher ein said dctennining and said removing occur in a kernel mode of the data 
proce ssi ng system . 

2, (Original) The article of claim I , wherein the operating system further includes a 
graphical user interface (GUI), virtual memory management and multitasking. 

3, (Original) The article of claim 1, wherein dclcrmining whether the storage device 
includes the protected arcsi comprises: 

checking whether (he storage device supports a protected area specification; and 
identifying a protected storage capacity and an unprotected storage capacity of the 
storage device. 
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4. (Original) The article of claim 1 , wherein removing ihe storage area protection 
comprises volatilely resetting a storage address value. 

5. (Original) The article of chiim 4, wherein resetting a storage address value 
comprises calling a MAX ADDRESS command. 

6. (Cajicellcd) 

7. (Original) The article ofclaim 4, wherein the storage area protection of the 
storage device is restored by the data processing system tipon system reboot, leaving the storage 
device unattered. 

8. (Original) The article of claim 1 , wherein the operations further comprise: 
scannijug the formerly protected storage area; and 

identifying file system information in the foniierly protected storage area. 

9. (Original) 'Fhe article of claim 1 , wherein providing the information derived from 
the fomicrly protected storage area comprises sending the infomiation over a transport medium 
to the data processing system detection tool. 

1 0. (Original) The article of claim 9, wherein the operations further comprise 
reconstruclmg a file system of the formerly protected storage area to derive the information. 

1 ! . (Original) Tlie article of claim 9, wherein providing the infonnation derived from 
the fonncrly protected storage area further comprises selecting the transport medium from a 
group including a peripheral device interface medium and a network communications medium. 
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1 2, (CurrenHy Amended) An '^¥he aiticic comnrisinu a mach in e-readable medium 
enibodyi tm ini>truction s th at when performed by one or more m ach ines result in operations 
coinnrisimi: e^4ftmKm 

dclennininR whether a .storage devi ce , in a data nroc essi ng system lunnina an operating 
systcnn i ncludes a pr otcclcd area, the op cratin u system inchid ii m a hardware abstraction la vcr: 

removing the storage area protection of the storaue device froo) witlijn the nmning 
m>ci:atmi3:_s ysiem and without rebooting the d ata processing system: and 

providinp. inlbnnation derived from the formerly protected storaue area to a data 
processing syste m detection toot: 

v^dlcrQin prov iding the i nfor mation derived from th e formerly protected storage area 
c.oniprises scndi n ji> the infonnation over a transport mediu m to the d ata processing syste m 
detection tool: 

wherein pr oviding the information derived from the f onn er I v protected storage area 
iuilher_co mprises selecting the transport medium from a group including a peripheral dcyic c 
interface medium and a network communications medium; and 

wherein sending the information over the iranspon medium comprises sending the 
inlbnnation in packets having a packet stiucturc useable over both the peripheral device interface 
medium and the network communications medium. 

1 3. (Original) The article of claim 1 2, wherein the packet structure is useable over a 
Universal Serial Bus (USB) and over im Internet Protocol (IP) network. 

!4. (Original) Tlic article of claim 1 2, wherein the packet structure includes a packet 
identifier field, and the operations further comprise specifying a detection-tool packet identifier 
(or each packet. 

15. (Original) The article of claim 12, wherein the packet structure allows for only a 
one-to-one connection. 
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16. (Original) The article of claim J 2, wherein the packet structure specifics small 
packets to reduce latency. 

17. (Original) A method comprising: 

loading a kernel-mode sollware module in a computing system running an operating 
system; and 

without rebooting the computing system, using the kernel-mode software module lo 
perform opcratio()s irom within the operating system, the operations comprising 

determining wlicther a storage device in the computing system includes a protected area, 

and 

rcvcrsibly removing the storage area protection. 

1 8. (Original) Tlie method of claim 17, wherein loading the kernel-mode software 
module comprises comnuiiiicatively coupling a machine-readable medium with the computing 
system* a detection agent being tangibly embodied in the machine-readable medium to run and 
dynamically load the kernel-mode software module without altering the storage device. 

1 9. (Original) 'f he method of claim 1 8, wherein the machine-readable medium 
comprises an optical disk. 

20. (Original) The method of claim ] 7, further comprising: 
scanning the formeriy protected storage area; and 

identifying file system information in the fomicrly protected storage area. 

2 1 . (Original) The mcUiod of claim 1 7, further comprising sending information 
derived from the formerly protected storage area over a selected transport medium to a data 
processing system detection tool. 
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22. (Original ) The method of claim 21 , wherein sending the intbrmatioii over the 
selected transport medium comprises sending the information in packets having a packet 
»>lructurc useable over both a peripheral device interface medium and a network communications 
medium. 

23. (Original) The method ofclaim 22, wherein the packet structure includes a packet 
identifier field used by the detection tool, and liie packet structure specifics small packets to 
reduce latency. 

24, (Original) A system comprising: 

a data processing system detection tool; and 

a kernel-mode software module operable to provide the detection tool with access to a 
protected area of a storage device in a data processing system when the kemel-modc software 
module is loaded into the data processing system. 

25, (Original) The system of claim 24, wherein the detection tool is operable from 
within the data processing system to access the storage device over a bus, Ihe system further 
comprising a hardware write blocker operable to allow the kcnicl-mode software module access 
to a firmware command. 

26, (Original) The system ofclaim 24, wherein the detection tool is operable as a 
stand alone application and as a client application. 

27. (Original) The system ofclaim 24, further comprising a detection agent operable 
to send infonnation to the detection tool, the detection agent being operable to load the kernel- 
mode software module in the data processing system and communicate with the loaded kernel- 
mode software module and with the detection tool. 
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28. (Original) The systctii orclaim 27, wherein ihe detection agent is iiirlhcr operable 
to rcconsiruct u file sy.stem of the prolecled storage area and send the reconstructed file system 
iiilbrmalion to the detection tooL 

29, (Original) Tlic syijiem of claim 27, wherein the detection agent is ftirther operable 
to select a transport medium from a group including a peripheral device interface medium and a 
network communications medium, and the detection agent communicates with the detection tool 
using a common a packet strvcture useable over both the peripheral device interface medium and 
the network communications medium. 

-^0- (Original) The system of claim 29, wherein the packet structure includes a packet 
identifier field used by ihe detection tool, and the packet structure specifies small packets lo 
reduce latciiey. 

3 ) , (Original) The system of claim 24, fiirther comprising a software write blocker. 

32. (Original) Tlie system of clahn 24, wherein the detection tool comprises a 
computer forensics tool. 

33. (Original) The system of claim 24, wherein the kernel-mode sollwarc module 
comprises a device driver. 

34. (Original) The system of claim 33, wherein the device driver compri.scs a 
Windows Driver Model (WDM) driven 



35. (Original) The system of claim 33, wherein the storage device comprises an ATA 
hard disk. 
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36. (Cuncntly Amended) A vsystem comprising: 

means for directly accessing a protected area of a storage device in a data processing 
system live from a high level operating system without a reboot; and 

means for delivering information derived from the protected storage area to a data 
processing system detection tool; 

wher ein the means for deli vering comprises mxiUi-transoort means for delivq ing^the 
infomiat ion, including mmns for commnnjcatin)^ over a network to support: remot e i maging and 
anatvsis of the directly accessed protected a rea. 

37, (Cancelled) 
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